The OFB mode produces the same ciphertext whenever the same
plaintext enciphered using the same key and starting variable. More
over, in the OFB mode the same key stream is produced when the same
key and start variable are used. Consequently, for security reasons
a specific start variable should be used only once for a given key.

o

The absence of chaining makes the OFB more vulnerable to specific attacks.

o

The use of different start variables values prevents the same
plaintext enciphering to the same ciphertext, by producing different
key streams.

o

Selection of a small value for j will require more cycles through
the encipherment algorithm per unit of plaintext and thus cause
greater processing overheads.

o

Only multiples of j bits can be enciphered.

o

OFB mode of operation does not extend ciphertext errors in the
resultant plaintext output. Every bit error in the ciphertext causes
only one bit to be in error in the deciphered plaintext.

o

OFB mode is not self-synchronizing. If the two operation of
encipherment and decipherment get out of synchronism, the system needs
to be re-initialized.

o

Each re-initialization should use a value of the start variable
different from the start variable values used before with the same
key. The reason for this is that an identical bit stream would be
produced each time from the same parameters. This would be
susceptible to a known plaintext attack.

As for ECB encryption but increases the key length to 168 bits.
There are theoretic attacks that can be used that make the effective
key length 112 bits, but this attack also requires 2^56 blocks of
memory, not very likely, even for the NSA.

o

If both keys are the same it is equivalent to encrypting once with
just one key.

o

If the first and last key are the same, the key length is 112 bits.
There are attacks that could reduce the effective key strength
to only slightly more than 56 bits, but these require a lot of memory.

o

If all 3 keys are the same, this is effectively the same as normal
ecb mode.